Beauhurst Privacy Notice

Contents

1. Who we are
2. The three relationships in which we handle personal data
3. Where we get personal data, and what we collect
4. Why we process personal data, and our legal basis
5. Who we share personal data with
6. Sending personal data outside the UK
7. How long we keep personal data
8. How we protect personal data
9. Your rights
10. Cookies and similar technologies
11. Children
12. Changes to this notice
13. People in our company intelligence
14. Our API, CRM integrations and MCP connector
15. Beauhurst Companion (browser extension)

1. Who we are

Beauhurst is the trading name of Business Funding Research Limited, a company registered in England and Wales (number 07312969) with its registered office at Fourth Floor, Brixton House, 385 Coldharbour Lane, London SW9 8GL. We are registered with the Information Commissioner’s Office as a data controller under number Z291194X.

We are the controller of the personal data described in this notice. Our General Counsel is also our Data Protection Officer, and can be reached at dataprotection@beauhurst.com or at the registered office above.

This notice tells you what personal data we handle, why, on what legal basis, who we share it with, how long we keep it, and what rights you have. It is written to be read, not navigated, and we would rather you told us it is unclear than gave up on it.

2. The three relationships in which we handle personal data

Most privacy notices start with a list of data. We start with the relationship, because what we do with your personal data, and what you can ask of us, depends entirely on which of these three describes you.

These are not mutually exclusive. If you are a named user and also appear in our company intelligence, both apply to you.

A point about our subscribers. When a subscribing organisation accesses data through Beauhurst, it decides independently what to do with it. We do not instruct it and it does not instruct us: we are two independent controllers, not a controller and a processor. That matters practically, and section 9 explains what it means for your rights.

And a point about what we do not hold. We hold information about the people who use the platform only where we need it to give you access, run the service securely, or where you or your employer have given it to us. We do not collect human-resources, employment or demographic information about our subscribers’ staff.

3. Where we get personal data, and what we collect

Grouped by where it comes from.

3.1 Information you give us

Your name, business email address, employer, job title and telephone number when you enquire, request a demo, register for an event, or get in touch with us in any other way, together with the content of what you send us.

If you apply for a role, your application and CV. If you agree, we may also contact you about other roles while we still have your application; section 7 says how long we keep it.

3.2 Information generated when you use our products

For named users: login credentials, IP address, device and browser information, and a record of your activity on our services, including the things you look at, search for, set up, export and ask us about. That is a description of the kind of thing we record rather than a complete list, because the platform changes; the principle is that we record what you do in the product so we can run it, secure it and improve it.

3.3 Information we collect from public and third-party sources

This is the platform data, and it is the largest category. It comes from Companies House, the UK Intellectual Property Office, published news and other public web sources, and our own analysts’ research. It covers people associated with companies we track in the United Kingdom and, currently, Germany and Ireland. Section 13 sets this out in full.

3.4 Information collected automatically on our website

IP address, device and browser data, pages visited, marketing attribution data and your cookie choices. See section 10.

3.5 Information from our own suppliers

Our customer relationship and marketing tools record how you engage with what we send you. We also use business contact-data providers to identify organisations that might want to hear from us; where we do, we decide what to collect and why, so we are the controller of that information rather than the provider. Named suppliers are in section 5.

4. Why we process personal data, and our legal basis

We do not sell personal data, and we do not use it to make automated decisions that have a legal or similarly significant effect on anyone.

4.1 Artificial intelligence and machine learning

When you use an AI-assisted feature. Some features — Lenses, Custom Data and Natural Language Search among them — work by sending what you type to a third-party AI provider, which returns a structured search we then run against our own data. The text of your query leaves our systems to make that happen. If you include a person’s name in your query, that name goes with it.

Two things we have put in place around that:

• Nothing is kept along the way. Our AI gateways are configured to store no queries or responses, and to route only to model endpoints that neither retain what we send nor train on it. A request that would breach those limits is rejected rather than sent. Where a provider will not allow retention to be switched off, we do not use that provider’s own endpoints.
• Providers may not learn from it. We choose which models to use on this basis: we route requests only to providers whose published terms say they will not use what we send to train their models.

The AI gateways we use, and where they process data, are named in the table in section 5, together with how requests reach the model providers that run them. Treat that table rather than this paragraph as the current position, because providers change as the technology develops. We keep our own record of these requests so that we can see the service is working, and they also form part of the product usage records described in section 7, which sets out how long each is kept.

People do occasionally read queries, in three situations: when you raise a support request and we need to see what happened in order to fix it; when we check how well a feature is working, which we do in aggregated or anonymised form; and where a query forms part of the product usage records described in section 7, which a small number of colleagues can access.

Improving the product with machine learning. We use machine learning and AI to make the product work better — most obviously to improve how accurately search returns the companies you are looking for. To do that we may use information about how the platform is used: the kinds of searches people run, queries to AI features, and which results they find useful. We use the minimum information needed, and we anonymise or aggregate it before we use it for this purpose. Where we can, we use synthetic data instead.

Using machine learning to produce information. We also use machine learning and AI to create and enrich what appears in the product, summarising a news article into a short entry, for instance. Some of that material is about named people: that someone has been appointed to a role, or has left one. Where it is, it forms part of the information described in section 13, and it may appear in other places in the product, including alerts we send you.

We do not train or evaluate models on the content you create in the platform. The names you give your collections, and anything synchronised into Beauhurst from your own systems, are yours and stay out of it. Your searches and queries are different: they are a record of how the product is used, and they are covered above.

Machine-generated output is validated automatically and, where appropriate, checked by a person. Before we deploy a model that processes personal data, we assess the risks first, and we carry out a data protection impact assessment where one is required. If you think something we hold about you is wrong, section 9 explains how to ask us to correct it, and that applies to material we have generated exactly as it does to anything else.

5. Who we share personal data with

Our subscribers. Platform data is made available to subscribing organisations under contract, subject to the permitted-use restrictions in our subscription terms. Each of them decides independently how to use it.

Our suppliers. These process personal data on our instructions, under a data processing agreement, and may not use it for their own purposes. Every supplier that handles our information is security-assessed before we onboard it and reviewed at least annually. This table lists the suppliers that receive or store information about the people who use Beauhurst, or about the people in our company intelligence.

Our AI routers, OpenRouter and Requesty, pass each request on to the model provider that runs it. Which providers those are changes as the models change, so rather than list them here we keep a current list of them, and of our other sub-processors, which we will send you on request.

Others. Our professional advisers — lawyers, accountants and auditors — where they need it to advise us. Law enforcement, regulators or courts where we are legally required to disclose. A buyer or investor, and their advisers, if we sell or reorganise the business, under confidentiality obligations.

We keep this list current and update it when it changes.

6. Sending personal data outside the UK

The platform is hosted in the United Kingdom, and subscriber data is held in data centres in the United Kingdom and the European Union. Where we use suppliers, their data centres are in the UK or the EU wherever practicable.

Our suppliers. Where a supplier processes personal data outside the UK, we rely on the UK Government’s adequacy regulations where they apply, or on the International Data Transfer Agreement or the UK Addendum to the European Commission’s standard contractual clauses, supported by an assessment of the transfer. Section 5 says which applies to each.

Our own people. Some of our staff and contractors work outside the United Kingdom and access our systems remotely to build, run and support the platform. That access is through centrally managed devices, granted on a least-privilege basis, limited to what the person’s role requires. Where a contractor outside the UK processes personal data on our behalf, we put a transfer agreement in place. You can ask us which countries are involved at any time.

Our subscribers. Some subscribing organisations are outside the United Kingdom, and data they take from the platform reaches them there. Our Data Policy treats access to the platform as a transfer and, for organisations outside the UK and EEA, incorporates the UK Addendum to the European Commission’s standard contractual clauses into their subscription.

You can ask us for details of the safeguard applying to a particular transfer.

7. How long we keep personal data

8. How we protect personal data

The platform is a multi-tenant service hosted on Amazon Web Services in the United Kingdom. Each subscribing organisation’s data is logically separated, with tenant-aware access controls designed to stop one subscriber reaching another’s data.

Information is encrypted in transit using TLS 1.2 or higher, and sensitive information is encrypted at rest, including in backups, using industry-standard algorithms with keys held in a managed key service. Passwords are hashed and salted and are never stored in readable form. Access within Beauhurst is role-based and granted on a least-privilege basis — only where someone needs it to do their job — with multi-factor authentication and single sign-on, a formal joiner-mover-leaver process, and periodic access reviews. Devices used to reach our information are centrally managed, encrypted and patched. Audit logs covering authentication, data access, administrative actions and security incidents are write-protected and retained in line with section 7.

The platform and confidential data are backed up daily, restoration is tested quarterly, and backups are held in a vault protected against deletion or alteration. We commission external penetration testing annually; critical findings are remediated immediately and a re-scan commissioned.

We hold Cyber Essentials Plus, the UK government-backed certification, independently audited at the Plus level and awarded on 22 June 2026 across the whole organisation, with recertification due in June 2027. We do not ourselves hold ISO/IEC 27001 or SOC 2 Type II; our cloud hosting provider holds both at the infrastructure layer under the shared-responsibility model.

No system is perfectly secure. We run a documented incident response process: incidents are triaged within one working hour and reviewed within five business days of resolution. If a breach meets the threshold in the UK GDPR we will tell the Information Commissioner’s Office within 72 hours of becoming aware of it, and we will tell affected people as soon as practicable, including what was affected and what we are doing about it. If you think you have found a security vulnerability, our responsible disclosure policy explains how to tell us.

9. Your rights

You can ask us to give you a copy of your personal data, correct it if it is wrong, delete it, restrict what we do with it, or send it to someone else in a portable form. You can object to the processing we carry out on the basis of legitimate interests — which includes our company intelligence and the product improvement described in section 4.1. Where we rely on your consent, you can withdraw it at any time. You can opt out of marketing in any message we send, or by writing to us.

Write to dataprotection@beauhurst.com. We will respond within one month. We may ask you to confirm your identity — not to obstruct you, but because handing personal data to the wrong person is itself a breach.

One practical point on deletion. We run separate testing environments that are rebuilt from the live system roughly once a month. When we delete or suppress something, the change reaches those environments at the next rebuild rather than instantly, so there can be a short lag before it has taken effect everywhere.

9.1 Two tracks

Some of the personal data that concerns you sits with us, and some sits with a subscribing organisation that obtained it from us and now handles it independently.

• For what we hold, come to us. We will deal with it.
• For what a subscriber holds, that organisation is an independent controller and its own privacy notice governs. We cannot exercise your rights against it or on its behalf. What we can do — and will — is tell you the categories of recipient that have received your data, so you know where to direct the request, subject to our confidentiality obligations.

9.2 Objecting to appearing in our company intelligence

If you are in our company intelligence because of a role you hold, you have the right to object. We take those objections seriously and they are handled by our Data Protection Officer rather than by a queue.

We will stop unless we can show compelling legitimate grounds that override your interests, and we will explain our reasoning either way rather than simply asserting a conclusion. Where we can meet the objection in part — by suppressing a home address while keeping a directorship that is a matter of public record, for instance — we will say so and offer it.

9.3 Complaints

If you are unhappy with how we have handled your personal data, please tell us first — we would rather fix it. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. Complaining to us does not affect that right.

10. Cookies and similar technologies

We use cookies and similar technologies on our website, and our products store information on your device where they need to in order to work. “Similar technologies” is doing real work in that sentence: it covers local storage, software development kits, tracking pixels and anything else that stores information on, or reads information from, your device.

We set only strictly necessary technologies without asking you. For everything else we ask first, and you can change your mind at any time. Our cookie notice has the detail.

11. Children

Our products are not intended for children and we do not knowingly market to them.

One point of honesty is owed here. A person can be appointed a company director in the United Kingdom at 16. Because our company intelligence is built from public company records, it occasionally includes people under 18 in their capacity as directors or shareholders. We apply extra care to those records and treat any objection concerning a person under 18 as a priority.

12. Changes to this notice

We review this notice at least annually and whenever we launch something that changes how we handle personal data. When we change it we update the version and date below and record what changed, so you can see the history rather than take our word for it. Where a change materially affects you we will tell you directly.

13. People in our company intelligence

This section is for you if you have no relationship with Beauhurst and did not give us your data. We collected it from public sources, third-party services and from business contact-data providers, and the law requires us to tell you what we hold and why.

Who this covers

Directors, shareholders, persons with significant control, founders, senior employees and other people associated with companies we track in the United Kingdom, Germany and Ireland.

What we hold

Your name; your professional title and role; whether you are recorded as a key person at the company, and the function you work in; professional contact details; the month and year of your birth as filed at Companies House; your correspondence or residential address and country of residence as publicly filed; your nationality as publicly filed; your shareholdings; the companies you are associated with; public-record filings; your professional history; mentions of you in published news; and your inventorship of patents. Some of this is information we have created rather than collected, a short summary of a news article, for example, which may be generated by machine. Section 4.1 explains how that works and how we check it.

Where we get it

Public company registries, intellectual property registers, published news and other public sources, our own analysts’ research, and material we generate from those sources using machine learning (section 4.1). We obtain business email addresses in three ways: from public sources; by working them out from a person’s name and their employer’s email format and checking that they are valid; and from third-party contact-data services. We check and update this information at regular intervals, mostly automatically, and we correct it when we find or are told that it is wrong.

Why, and on what basis

We compile this information so that our subscribers — investors, advisers, public bodies and companies — can identify, research and assess businesses, including transactions that are never publicly announced. Our legal basis is legitimate interests: ours in operating the business, and our subscribers’ in having reliable information about the companies they invest in, advise, fund, regulate or sell to.

We have assessed that interest against yours. The short version: The information is largely drawn from records that are public by law precisely so that the people behind companies can be identified; it concerns you in a professional capacity rather than a private one; we do not use it to market to you personally; subscribers are required to destroy the information when their subscription ends; and you can object. The full assessment is available on request.

Our Data Policy also limits what subscribers may do with contact details taken from the platform, including limits on bulk and repeat contact and a requirement to stop when someone asks.

Where we hold an email address on our platform that is available to all of our subscribers, we write to tell the person that we hold their information. Where the address came from a contact-data provider instead, we do not write individually — this notice is how we tell you, and section 9.2 explains how to object.

How long we keep it

For as long as you remain on the relevant public record in a role we track, subject to your right to object.

Your rights, including objecting

See section 9, and section 9.2 in particular. Our Data Protection Officer handles these personally.

14. Our API, CRM integrations and MCP connector

What this covers

Three ways of using Beauhurst data outside our own platform: our REST API, our CRM integrations (currently HubSpot, Salesforce and Microsoft Dynamics), and our MCP connector, which lets you reach Beauhurst data from inside an AI assistant.

What we collect from you

The API. We hold the credentials and tokens issued, and we log requests (which endpoints, when and how many) to operate the service, enforce rate limits and investigate misuse. Access is authenticated with a key tied to a user account, so a request tells us which subscription it came from and which account made it.

The MCP connector. The connector signs in through your own Beauhurst account. We record which company or person was requested, and by whom. We do not see the conversation behind the request. The question you asked your AI assistant, and everything else in that conversation, stays between you and whichever assistant you are using.

The CRM integrations. Connecting a CRM does not create a new record of you. The connection is made under your organisation’s subscription, and your email address is already held as part of your user account. What the connection itself holds is the access token, which is tied to the person who authorised it and which we encrypt in transit and at rest. We also record who connected the integration, and each time it runs, against the account that set it up. Those records show that an enrichment happened, not what was enriched.

Our legal basis for all three is performance of our contract with your employer, and our legitimate interest in a secure, functioning service. We keep the records described above for the same period as the equivalent records from the platform itself; section 7 sets out how long that is.

How the MCP connector differs from Natural Language Search.

Both involve AI, but what reaches us is different. With Natural Language Search, and other similar on platform features, you type into Beauhurst and the text of your query comes to us and goes on to an AI provider (section 4.1). With the MCP connector, the conversation happens in your own AI assistant; all that reaches us is the request for a particular company or person. We never see what you asked, or why.

What these deliver

All three deliver company intelligence, including the personal data described in section 13, into your employer’s own systems. Once it is there, your employer is an independent controller of it: we do not control what happens to it and we cannot exercise anyone’s rights over it. Our subscription terms restrict what it may be used for, and the Data Policy governs what may be shared beyond the subscribing organisation. They are also required to destroy it when their subscription ends.

Where this goes. The company intelligence you request is delivered to wherever you have asked for it, which may be outside the United Kingdom. Section 6 explains the safeguards that apply, here and everywhere else in this notice.

If you are a person described in section 13 and want to know whether your data has been delivered this way to a particular organisation, ask us. Subject to the confidentiality we owe that organisation, we will tell you.

Integrations

Where you connect Beauhurst to your CRM, you choose which companies we send data about, either by syncing a collection, or by enriching records already in your CRM. Data flows at your instruction and on your configuration.

Anything you synchronise into Beauhurst from your own systems is treated as your content: we do not use it to train or evaluate models (section 4.1), and where it includes personal data about your own contacts, you remain responsible for it.

15. Beauhurst Companion (browser extension)

Beauhurst Companion is our browser extension. It shows Beauhurst’s information about whichever company’s website you are looking at. To do that it reads the address of the tab you have open and sends us the website address so we can look the company up. It does not read the content of any page. Companion has its own privacy notice setting out what it keeps, for how long, and how to turn it off. We will add the link here when it is published.